0

I'm asking this question because all if not most literature out there indicates that there is a listening or responding entity that is involved in an attack.

If I was behind a router that does not respond to ICMP or listen/NAT any services on UDP/TCP. Am I susceptible to a DDoS attack?

Improve this question
6
  • 2
    Basically any system connected to the internet is susceptible of been attack.
    – camp0
    Feb 3, 2020 at 11:17
  • Do you have any data/techniques to prove it?
    – MFT
    Feb 3, 2020 at 11:37
  • 1
    @MFT, What you're thinking here is that you've mitigated your risk of being used in an amplification DDoS (E.g. running an OpenDNS resolver or leaving LDAP ports open etc) which is for the most part true however, no one is really free from a Bandwidth based DDoS attack on their network.
    – ditrapanij
    Feb 3, 2020 at 12:30
  • We have a user here, @Satish, whose company gets hit with DDoS attacks. Perhaps he can explain the realities to you.
    – Ron Maupin ♦
    Feb 3, 2020 at 15:10
  • I welcome the explaination, thanks in advance.
    – MFT
    Feb 3, 2020 at 15:33

1 Answer 1

Reset to default
1

If I was behind a router that does not respond to ICMP or listen/NAT any services on UDP/TCP. Am I susceptible to a DDoS attack?

Yes. At least on the bandwidth side, there could be more data coming in than the Internet downlink can handle. A severely congested interface loses massive amounts of packets and becomes unusable.

A faster Internet access makes a bandwidth-based attack harder, but any bandwidth can be exceeded with DDoS, especially when using amplification techniques.

With destination NAT on the router, you're additionally susceptible to have the NATed service or device overloaded. Depending on the firewall and the host configuration, a targeted (D)DOS attack may be much easier to achieve than a purely bandwidth-based attack.

Improve this answer
10
  • Thanks Zac, how do you initiate a bandwidth attack, Layer 3 of course on a non-listening/responding device? In this case, it is a routed interface, a point-to-point link to the ISP?
    – MFT
    Feb 3, 2020 at 12:41
  • 2
    You simply send lots of traffic to the target. It doesn't matter if the target is listening or not: the traffic still consumes the bandwidth.
    – Ron Trunk
    Feb 3, 2020 at 13:09
  • 2
    It wouldn't help a thing, you can only process it after it reaches you.
    – Teun Vink ♦
    Feb 3, 2020 at 14:17
  • 4
    I think you're over-thinking this. If I send a thousand cars to a particular street address, it doesn't matter if there is a building there or not. The roads will be congested with all the cars. It's the same with network traffic: even if your router is configured to drop all the traffic, the packets have already consumed the bandwidth by the time they get to your router.
    – Ron Trunk
    Feb 3, 2020 at 14:38
  • 3
    @jonathanjo That's fine in the case where the attack comes from a single address. but) DDOS attacks, by their very nature, come from hundreds or thousands of source addresses. Blocking those is not so simple.
    – Ron Trunk
    Feb 3, 2020 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.